Any open source project can allow you to verify binaries by making builds reproducible. The fact that most apps don't do this is indeed a security problem, but

Any open source project can allow you to verify binaries by making builds reproducible. The fact that most apps don't do this is indeed a security problem, but one that's far from unfixable.